Avoid infinite recursion for projects that define requirements via requirements.txt

[rmartin16]

Describe the bug

Output formats such as Android Gradle, Flatpak, and Web use a file named requirements.txt internal to the build process to create the distributable artifact. If a project itself defines a requirements.txt in requires, this results in infinite recursion during the build process as pip attempts to install its own requirements.txt.

Steps to reproduce

1. Create a requirements.txt
2. Add -rrequirements.txt to requires
3. Run briefcase build android, briefcase build linux flatpak, briefcase build web
4. See error

Expected behavior

Use an internal filename for requirements that is less likely to collide with a requirements file defined via pyproject.toml.

Screenshots

No response

Environment

• Operating System: pop os 22.04
• Python version: 3.12.14
• Software versions:
  • Briefcase: 0.3.18.dev229+ga1c5e9bf.d20240424

Logs

briefcase.2024_04_24-10_34_53.build.log

Additional context

No response

[freakboy3742]

It's definitely problematic that Briefcase can get into an infinite loop, but the way that is happening is definitely "off script" usage of requires. The fact that pip arguments can be passed to requires is more accident than intention.

Rather than try and make this work by using a different name for the requirements file (which, ultimately, can always fail, because no matter what name we use, you can pass that name as -r<that name> - I'd be inclined to add validation to check the values in requires to ensure that they're all valid package specifiers. If they're not, we should at least raise a warning, if not a full error. The only reason to not use an error is that it's currently useful to be able to pass in different package repositories and other install configuration options - but if we can resolve issues like #1270, then the need to support this sort of extension is minimized.

[mhsmith]

pip could certainly give a better error message in this situation, so I think this should be reported in their issue tracker, if it hasn't been already.

[freakboy3742]

Logged as pypa/pip#12653.